Traitorous Failures and Consensus

1
Traitorous Failures and Consensus

• Dennis Shasha (following Lynch, Fischer, Merritt)

2
Problem Statement 1

• Three generals A, B, and C.
• At most one is a traitor.
• The traitor knows the protocol and the inputs of
  the others.
• The generals must decide to attack or not to
  attack (analogous to commit or abort).

3
Problem Statement 2

• Each day each general wakes up with an
  inclination to attack or not to attack.
• The generals then talk to one another by two way
  phone.
• So, A cannot overhear the conversation of B with
  C and symmetrically.

4
Problem Statement 3

• If all generals wake up with an attack
  inclination, the non-traitors should attack
  (liveness 1)
• If all generals wake up with a non-attack
  inclination, the non-traitors should not attack
  (liveness 2).
• If some wake up wanting to attack and others not,
  then either both non-traitors should attack or
  both should not attack (safety).

5
What Makes this Hard

• If all generals could get together in a single
  room, they could simply vote.
• If two vote to attack then at least one
  non-traitor wanted to attack, so attacking
  accords with the rule.
• If two vote not to attack then at least one
  non-traitor didnt want to attack, so thats ok.

6
Communication Is Only Two Way

• If A is a traitor, then A could say one thing to
  B and another thing to C.
• B and C could later communicate, but they
  wouldnt know whether the inconsistency came from
  A or from one another.

7
Scenario 1

• All generals have an inclination to attack.
• However C is a traitor. What each general says is
  in parentheses next to it.
• C(no) (yes)A(yes) (yes)B(yes) (yes)C
• A and B should both say attack.

8
Scenario 2

• A has an inclination to attack. C does not and B
  is the traitor.
• C(no) (yes)A(yes) (yes)B(no) (no)C
• To A, the situation is as it was for Scenario 1,
  so A attacks. C, in order to preserve safety,
  must also attack.

9
Scenario 3

• Nobody has an inclination to attack. A is the
  traitor
• C(no) (yes)A(no) (no)B(no) (no)C
• To C, the situation is as it was in scenario 2,
  so C attacks. But this violates our second
  liveness condition.

10
Summary

• Even if you have only one traitor, two way
  communication cannot guarantee a correct decision
  among three generals.
• Three way communication could have done so and so
  could signed communication, because then no
  general could have told inconsistent stories.

11
Postscript

• If I were two-faced, would I be wearing this
  one? Abraham Lincoln